fail2ban and waf

Hi all,

No replies, but perhaps...weekend...? :-)

I have started looking at the API docs, and can successfuly authencticate via the API, so the basic procedure works. But, before continuing, I decided to ask again for advise:

Looking at the API, I see a way to create an IPHost / HostGroupList, and to remove it again, but nothing to add/remove single IPs from an HostGroupList.

My idea was to create a 'blacklist' firewall rule, matching an IPHost HostGroupList, and add/remove IPs to that list using the API, from a script from Fail2Ban.

Question: Am I overlooking something? Is there really no easy way to add/remove single IPs from such a definition? Is there another way to mass-block IPs?

I also looked at URL blacklists, but those are about URLs and not IPs, and browsing-only. Plus: it seems they are not refreshed often enough.
(and strangely only supported over http and not HTTPS??!! Really??)

Anyway, again: tips and advise would be very welcome! :-)

Enjoy your Sunday and stay healthy!

Really? No one here is doing this, or am I missing something that is that obvious to everybody, that no one can be bothered to point it out to me?

Hi mouk 

For API - https://community.sophos.com/kb/en-us/132560 and https://community.sophos.com/kb/en-us/132760 articles maybe help you, you may also take help of your professional services - https://www.sophos.com/en-us/support/professional-services.aspx

Hi mouk 

For API - https://community.sophos.com/kb/en-us/132560 and https://community.sophos.com/kb/en-us/132760 articles maybe help you, you may also take help of your professional services - https://www.sophos.com/en-us/support/professional-services.aspx